# Computer

<table><thead><tr><th width="203">Field</th><th>Type</th><th>Possible Operators</th><th>Description</th></tr></thead><tbody><tr><td><strong>Guid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A unique identifier that is a combination of GUID of selected <code>Scan</code> and Active Directory <code>ObjectGUID</code> of the object.</td></tr><tr><td><strong>FSName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A special unique identifier that is a combination of the <code>Name of the object</code> and the <code>Fully Qualified Domain Name of the Domain</code>.</td></tr><tr><td><strong>ObjectSid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Active Directory security identifier of object. (<strong>Ldap Display Name</strong>: objectSid)</td></tr><tr><td><strong>Name</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Name of the specified object. (<strong>Ldap Display Name</strong>: name)</td></tr><tr><td><strong>IsDomainController</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the machine is a Domain Controller server.</td></tr><tr><td><strong>OperatingSystem</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name of the operating system that runs on the computer. (<strong>Ldap Display Name</strong>: operatingSystem)</td></tr><tr><td><strong>OperatingSystemVersion</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The version of the operating system that runs on the computer. (<strong>Ldap Display Name</strong>: operatingSystemVersion)</td></tr><tr><td><strong>IsEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is enabled.</td></tr><tr><td><strong>DistinguishedName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Active Directory distinguished name of the object. (<strong>Ldap Display Name</strong>: distinguishedName)</td></tr><tr><td><strong>session_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates the number of sessions on the computer.</td></tr><tr><td><strong>explicit_localadmin_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates the number of explicit local admins on the computer.</td></tr><tr><td><strong>IsPrivileged</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is Privileged.</td></tr><tr><td><strong>IsSMBv202Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2.2 is active.</td></tr><tr><td><strong>IsUnsupported</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the computer runs an unsupported/obsolote operating system.</td></tr><tr><td><strong>IsAdmin</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is Admin.</td></tr><tr><td><strong>DNSHostName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Fully qualified domain name of computer as registered in DNS. (<strong>Ldap Display Name</strong>: dNSHostName)</td></tr><tr><td><strong>IsSpoolActive</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Spool service is running on the computer.</td></tr><tr><td><strong>WhenChanged</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date when this object was last changed. (<strong>Ldap Display Name</strong>: whenChanged)</td></tr><tr><td><strong>IsProtected</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is a direct or nested member of the Protected Users group.</td></tr><tr><td><strong>WhenCreated</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date when this object was created. (<strong>Ldap Display Name</strong>: whenCreated)</td></tr><tr><td><strong>MsDSSupportedEncryptionTypes</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The encryption algorithms supported by user, computer or trust accounts. The KDC uses this information while generating a service ticket for this account. Services and Computers can automatically update this attribute on their respective accounts in Active Directory, and therefore need write access to this attribute. (<strong>LDAP Display Name</strong>: msDS-SupportedEncryptionTypes)</td></tr><tr><td><strong>IsSMBv2v3SignEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2 and Version 3 protocol signing is enabled.</td></tr><tr><td><strong>HasLaps</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local administrator account on the computer is managed through LAPS(Local Administrator Password Solution).</td></tr><tr><td><strong>IPAddress</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>IPV4 Network address of the computer.</td></tr><tr><td><strong>risk</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The risk score of the object that calculated based on vulnerability counts and severities.</td></tr><tr><td><strong>UserAccountControl</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Flags that control different attributes and behavior of the objects. (<strong>Ldap Display Name</strong>: userAccountControl) (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol">Field Reference</a>)</td></tr><tr><td><strong>AllowedtoDelegateSpn</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains Service Principal Name definitions in the context of Constrained Delegation. (<strong>LDAP Display Name</strong>: msDS-AllowedToDelegateTo)</td></tr><tr><td><strong>SAMAccountName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (<strong>Ldap Display Name</strong>: sAMAccountName)</td></tr><tr><td><strong>DontReqPasswd</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object's password can be blank.</td></tr><tr><td><strong>DontReqPreauth</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Kerberos Pre-Authentication mechanism was disabled for the object.</td></tr><tr><td><strong>Cn</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name that represents an object. Used to perform searches. (<strong>Ldap Display Name</strong>: cn)</td></tr><tr><td><strong>IsSMBv2v3SignRequired</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2 and Version 3 protocol requires signing.</td></tr><tr><td><strong>HasReversibleEncryption</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is using reversible encryption instead of hash to keep credentials.</td></tr><tr><td><strong>IsSMBv210Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2.10 is active.</td></tr><tr><td><strong>SidHistory</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and that new SID becomes the objectSID. The previous SID is added to the sIDHistory property. (<strong>Ldap Display Name</strong>: sIDHistory)</td></tr><tr><td><strong>IsSMBv1Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 1 is active.</td></tr><tr><td><strong>PwdLastSet</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date and time that the password for this account was last changed. If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon. (<strong>Ldap Display Name</strong>: pwdLastSet)</td></tr><tr><td><strong>IsUsingDESAlgorithmForHashing</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is using an insecure DES algorithm in Kerberos protocol.</td></tr><tr><td><strong>AdminCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (<strong>Ldap Display Name</strong>: adminCount)</td></tr><tr><td><strong>LapsExpirationTime</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>Stores the password expiration time of LAPS. (<strong>Ldap Display Name</strong>: ms-Mcs-AdmPwdExpirationTime)</td></tr><tr><td><strong>LastLogon</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The last time the user logged on. This attribute is not replicated to other Domain Controllers. (<strong>Ldap Display Name</strong>: lastLogon)</td></tr><tr><td><strong>HasUnconstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Unconstrained Delegation is activated on the object.</td></tr><tr><td><strong>IsSMBPortOpen</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether port 445 of the computer is accessible.</td></tr><tr><td><strong>LogonCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of times the account has successfully logged on. This attribute is not replicated to other Domain Controllers. (<strong>Ldap Display Name</strong>: logonCount)</td></tr><tr><td><strong>IsSMBv311Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3.1 is active.</td></tr><tr><td><strong>BadPwdCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of times the object tried to log on to the account using an incorrect password. (<strong>Ldap Display Name</strong>: badPwdCount)</td></tr><tr><td><strong>HasConstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Constrained Delegation is activated on the object.</td></tr><tr><td><strong>IsStealth</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object can compromise admin objects with at least one attack path.</td></tr><tr><td><strong>HasResourceBasedConstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Resource Based Constrained Delegation is activated on the object.</td></tr><tr><td><strong>IsSMBv300Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3 is active.</td></tr><tr><td><strong>group_delegated_localadmin_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates that the object has group delegated local admin privilege on how many computers.</td></tr><tr><td><strong>PrimaryGroupID</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains the relative identifier (RID) for the primary group of the object. (<strong>Ldap Display Name</strong>: primaryGroupID)</td></tr><tr><td><strong>IsSMBv302Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3.2 is active.</td></tr><tr><td><strong>LastLogonTimestamp</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The time that the user last logged into the domain. This attribute is replicated to other Domain Controllers but not updated until after 14 (msDS-LogonTimeSyncInterval) days. (<strong>Ldap Display Name</strong>: lastLogonTimestamp)</td></tr><tr><td><strong>SAMAccountType</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the account type of the security principal objects in Active Directory. (<strong>LDAP Display Name</strong>: sAMAccountType) (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype">Field Reference</a>)</td></tr><tr><td><strong>IsLocalAdmin</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer.</td></tr><tr><td><strong>HasProtocolTransition</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Constrained Delegation with Protocol transition is activated on the object.</td></tr><tr><td><strong>IsSMBv1SignRequired</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 1 protocol requires signing.</td></tr><tr><td><strong>DisplayName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The display name for an object. This is usually the combination of the users first name, middle initial, and last name. (<strong>LDAP Display Name:</strong> displayName)</td></tr><tr><td><strong>IsWindowsOS</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Determines whether the current operating system is a version of Microsoft Windows. It returns <strong>true</strong> if the OS is Windows, otherwise <strong>false</strong>.</td></tr><tr><td><strong>IsWindowsServer</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Checks if the operating system is a Windows Server edition. It returns <strong>true</strong> if the OS is a Windows Server, otherwise <strong>false</strong>.</td></tr><tr><td><strong>IsWSUServer</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Checks if the machine is configured as a Windows Server Update Services (WSUS) server. Returns <strong>true</strong> if it is a WSUS server, otherwise <strong>false</strong>.</td></tr><tr><td><strong>HTTPUpdateService</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Handles application updates by communicating with a remote server over HTTP. It fetches version information, compares it with the application's current version, and initiates the update process if necessary.</td></tr><tr><td><strong>IsInactive</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether a computer has been enabled but unused (no logon) for a period longer than the defined inactivity threshold</td></tr><tr><td><strong>ServicePrincipalName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>These SPN entries indicate that the computer has Kerberos service identifiers registered for both its hostname and fully qualified domain name under the HOST and RestrictedKrbHost service classes, allowing it to securely participate in Kerberos authentication.</td></tr><tr><td><strong>MsDsCreatorSid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Represents the security identifier (SID) of the account that originally created the Active Directory object, retrieved in binary form and converted to a readable SID string.</td></tr><tr><td><strong>Description</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Description text to display for an object. (<strong>Ldap Display Name</strong>: description)</td></tr><tr><td><strong>SmbShares</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Shared folders or printers on a network using the <strong>SMB (Server Message Block)</strong> protocol for file and resource sharing.</td></tr><tr><td><strong>ExposurePoint</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td><strong>ExposurePoint</strong>: A numerical value indicating the level of risk or exposure.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/search-and-reports/computer.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.